ICO’s call for views on a code of practice for the use of 
personal data in political campaigning: summary of 
responses 


In October 2018 the ICO issued a call for views on a proposed code of practice 
for the use of personal data in political campaigning. As part of this we asked a 
number of questions (see Annex A). 


Overall we received 45 responses (some of which were joint responses), as 
follows: 


Data subjects - 22 
Business/commercial enterprises - 3 
Public authorities - 1 

Third sector/voluntary organisations - 3 
Political Parties - 3 

Academics - 1 

Regulators - 2 

Other - 10 


We also held a workshop with political parties and a number of meetings with 
civil society groups, the Electoral Commission and the Centre for Data Ethics and 
Innovation. All of which were useful and constructive meetings. 


A wide variety of issues were raised with considerable detailed thought having 
been given to the questions. There were many practical suggestions on how the 
code might be structured and what it might include. We are grateful to all those 
who took time to provide input. 


We used these responses and subsequent engagement with political parties, civil 
society groups and public bodies to inform our drafting of a framework code of 
practice for the use of personal data in political campaigning. This draft 
framework code has now been published for public consultation. We hope to 
publish a final version in autumn this year. 


Whilst we cannot respond to all views given, we have provided an analysis of the 


key themes and provided a response to each of these. 


Key themes 
Definition of Political Campaigning 


Our Call for Views asked for opinions on our proposed definition of ‘political 
campaigning’. We suggested it be defined as: 


“activity, which relates to elections or referenda, in support of, or against, a 
political party, a referendum campaign or a candidate standing for election. This 
includes but is not limited to processing by registered political parties, electoral 
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candidates, referendum permitted participants and third party campaigners, as 
defined in Political Parties and Referendums Act 2000.” 


The majority of the respondents supported this definition. However, the 
following concerns were raised: 


e The proposed definition is not broad enough - a few respondents 
noted that democratic engagement is an all year-round activity, not 
restricted to election periods or referenda. For example, it can include 
internal party matters such as candidate selection contests, leadership 
contests, issues-based campaigns that seek to influence political opinion 
outside of elections or referenda. Also, the way data is used in elections 
is constantly evolving and the code must have a sufficiently clear, broad 
and flexible enough definition to respond to this effectively. 


e The proposed definition does not align with definitions in other 
legislation/definitions - some respondents noted that other legislation 
and guidance have different definitions, such as the amended definition of 
democratic engagement proposed in the Representation of the People 
Regulations 2001 and other definitions set out in electoral law. This could 
cause confusion. 


e The proposed definition should not diminish democratic 
engagement - some respondents noted that this definition might restrict 
democratic engagement by trying to clarify or narrow the lawful basis of 
‘democratic engagement’ provided for in the explanatory notes under the 
Data Protection Act 2018 (DPA 2018). It was suggested that we should 
make our definition identical to the explanatory notes definition. 


ICO Comment 


It is important to note that, although ‘political campaigning’ and ‘democratic 
engagement’ are often used interchangeably, ‘democratic engagement’ is a task 
in the public interest as set out and defined by the DPA 2018. The definition in 
the DPA 2018 does not cover all activities that our definition of political 
campaigning might cover. Nor will all the activities that fall under the 
democratic engagement definition fall under our political campaigning definition. 


Those processing personal data for political campaigning purposes will, in the 
majority of cases, fall under one of three lawful bases, ‘public task - democratic 
engagement’, ‘legitimate interests’ or ‘consent’. 


We do not consider that the proposed definition restricts the application of the 
framework code to official campaign periods only. The proposed definition does 
not refer to set timescales, rather it talks of activity related to elections or 
referenda. Such activity, as many respondents noted, can occur outside official 
campaigning periods. 


We do not consider that our proposed definition of political campaigning will 

restrict democratic engagement and that is not our intention. Our intention is to 

provide practical guidance and good practice recommendations to aid compliance 
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with the GDPR, DPA and the Privacy and Electronic Communications (EC 
Directive) Regulations (PECR) for those who intend to carry out political 
campaigning activities in relation to elections and referenda. 


The ICO works closely with the Electoral Commission and following its 
suggestion, we have chosen to describe those eligible to access the electoral 
register in the same way as they do in their guidance rather than as is worded in 
the relevant legislation. For example, we have replaced ‘permitted participants’ 
with ‘referendum campaigners’. This will help to make the terminology more 
accessible. 


Who should the code apply to? 
There were two key themes arising from responses to this question: 


Support for applying the code to any organisation that is directly or 
indirectly processing personal data in the political campaigning process. 
This included data brokers, analytical companies and online platforms/social 
media. Some suggested that anyone processing data for political purposes 
should be covered by the framework code. Other respondents suggested that 
marketing companies, the media, advertisers and agencies should also be 
included in the remit. 


Conflicting views on whether research institutes and pollsters should 
also be included under the scope of the framework code. Some 
respondents said they should be included and others said they should not. Those 
who were against the idea argued that the scope of the framework code should 
be tightly and clearly defined. They argued that market research including 
political polling, should not be considered to be political campaigning as it does 
not seek to change or influence opinions or behaviour but to gain insight. They 
note that this position is recognised in the current ICO guidance and say that the 
distinction between market research and political campaigning should continue 
to be explicitly recognised in the new framework code. 


ICO Comment 


Having considered this fully we have decided that the framework code will apply 
primarily to controllers processing personal data for political campaigning 
purposes. However, in practice this will have the effect of applying to processors 
and other controllers within this ecosystem. Controllers subject to the code, will 
need to ensure due diligence of their suppliers, joint controllers and processors. 


It is also worth noting that the framework code does not introduce any new data 
protection and electronic marketing law requirements, it simply clarifies and 
provides advice on existing requirements in terms of political campaigning. So, 
whether the framework code applies to an organisation or not, they will still 
need to comply with the same law. 
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With regards to market researchers there are various regulatory frameworks 
that already exist governing political market research. Market research is 
generally carried out to understand views on a subject matter. It is not carried 
out in order to influence those views. If market research strays from researching 
opinions to attempting to push certain political views or to sell a product to a 
specific individual, it is no longer considered market research and would in both 
cases be considered direct marketing. We agree that this distinction needs to be 
clearly explained. We have included a full explanation this in the framework 
code. 


Proposed topic areas 


There was strong support for the proposed topic areas in the framework code. 
Respondents raised a number of different areas they wanted to see covered, the 
vast majority of which we have included in the framework code. In particular 
respondents wanted to include: 


Lawful bases - including specific suggestions that the ‘public task -democratic 
engagement’ basis be included. It was also suggested that covering the 
conditions for processing special category data would be useful. 


Transparency - clearly a key topic, including in the context of the different 
actors such as political parties, candidates, the platforms and tools used to 
convey political messages. But also in terms of what the post political 
campaign/election considerations should be. 


Compatibility with electoral law. A number of respondents emphasised the 
importance of the content dovetailing with electoral law guidance. In addition, 
the use of data obtained from the electoral register was raised a few times. 
Some suggested that the law needs to be changed in this area and that we 
ought to respond to this point in the framework code. 


Online advertising models and the use of social media - many respondents 
noted that current commercial advertising models including social media are 
being applied to political campaigning. It was suggested that the ICO needs to 
ensure the framework code recognises this and addresses the different 
responsibilities and limitations. 


ICO Comment 


We agree that providing advice for each of the lawful bases that are most likely 
to apply to processing data for political campaigning purposes is important and 
have included this in the framework code. Similarly, relevant conditions for 
processing special category data have also been covered in detail. 


We agree that transparency is a key topic. The framework code provides 
practical advice and examples of compliance with transparency obligations at 
each stage in the process. We also include advice on compliance after a 
campaign. 
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We have worked hard to ensure that the framework code is consistent with 
electoral law and have discussed areas of cross-over with the Electoral 
Commission. We do not try to interpret electoral law and refer readers to the 
Electoral Commission for further guidance. 


The law around access to the full electoral register is not within the ICO’s remit. 
However, we consider access to this data for political campaigning purposes is 
important for campaigners to convey their messages to voters, furthering 
political debate and promoting democratic engagement and participation. 


It is also important to note that having access to the full electoral register does 
not exempt those processing personal data from complying with data protection 
law. This point is emphasised in the framework code. 


We agree that online commercial advertising methods are now forming part of 
the political campaigning landscape. We have included a chapter to help 
campaigners understand how data protection and electronic marketing laws 
apply to such methods. The framework code does not intend to advise on each 
individual type of technology/method being used, but does give general 
guidance about the use of new technologies and methods and how campaigners 
should consider their compliance with data protection law. 


Case study requests 


Respondents suggested a number of case studies or scenarios they wished to be 
included in the code. Case studies relating to our investigation into the use of 
data analytics for political purposes were most requested. 


Other case studies/ scenarios requested include: 


e acquiring individuals’ personal data through websites; 

e gathering data from third parties; 

e use of databases collected by one campaign group being made available 
to other campaign groups; 

canvassing door to door; 

how data minimisation in political campaigning could work; 

the use of political surveys and petitions which collect data; 

the use of social media; 

the use of third party analytics companies, and 

automated decision-making in the electoral context that might be 
considered to have a “similarly significant affect” (GDPR Article 22). 


ICO Comment 


We have considered all suggestions and have provided explanations and case 
study examples to illustrate how the law applies to these scenarios where 
appropriate. 


We have also taken some real life examples from our routine casework and our 
comprehensive investigation into the use of data analytics for political purposes 
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to help illustrate certain points. 


Respondents were asked for examples of guidance, tools or good practice that 
could aid compliance and be included in the framework code. We did not receive 
many practical examples of UK campaigning practices, but we did receive a 
number of useful recommendations of other material we should consider. This 
included guidance from other regulators, civil society and academic reports and 
studies, European Union and Council of Europe publications and frameworks. 


ICO Comment 


We thank respondents for their recommendations and considered each of them 
during our development of the framework code of practice. 
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Annex A 


ICO call for evidence - Code of Practice icO 
for the use of personal information in ° 
political campaigns 


Information Commissioner's Office 


The ICO’s new Code of Practice for the use of personal information in 
political campaigns will draw from our current Guidance on Political 
Campaigning, but will be fully updated to ensure it reflects the current 
Data Protection Act 2018 and GDPR requirements. It will also be widened 
to cover areas where our investigation found significant concerns or 
misunderstandings of the law. In addition, it will provide guidance and 
good practice recommendations to aid compliance. 


You can read the full background and legal basis for the production of this 
code on our website. 


Responses to this call for views must be received by 11.59pm on Friday 
21 December 2018 


If you would like further information on the call for views please 
telephone 0303 123 1113 and ask to speak to the Parliament and 
Government Affairs Department about the call for views on a new Code of 
Practice for the use of personal information in political campaigns or email 
politicalcampaigning@ico.org.uk. 


Privacy statement 

For this call for views we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q1 Do you agree with our understanding of ‘political campaigning’ and 
what processing should be covered by the code? 


L]ves 


[ ]No 


Please explain further: 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q2 Should the code apply to other data controllers in the political 
campaigning process, beyond registered political parties, electoral 
candidates, referendum permitted participants and third party 
campaigners? Eg data controllers processing personal data on behalf of 
political campaigns, parties or candidates. 


L Yes 
LJ 


Please explain further: 


Q3 Who should the code also be aimed at ie data brokers, analytical 
companies, online platforms? (List as many as you think are applicable) 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


We propose the code will include the following broad topic areas: 

- The role of data controllers in the political campaigning ecosystem; 

- Transparency requirements in practice; 

- Accountability, security and data minimisation requirements; 

- Lawful bases including the new ‘democratic engagement’ aspect of the 
‘public interest’ 

basis in the Data Protection Act 2018; 

- Using special category data; 

- The use of personal data from the Electoral Register; 

- Data collection directly from individuals; 

- Using personal data collected by third parties; 

- Personal data analytics; 

- Direct marketing including the application of the Privacy and Electronic 
Communications 

Regulations; 

- Online advertising and the use of social media; 

- Post political campaign/election considerations. 


Q4 Do you agree with the proposed topics? 


[_]Yes 
[_| No 


Please explain further: 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q4c Is there anything we have not listed that ought to be included? 


[ ] Yes 
E No 


Please specify: 


Q4b What topic areas in particular ought to be covered in the most detail? 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q5 What do you think should be covered in the new code of practice that 
isn't covered in current political campaigning guidance? 


Q6 What factors ought to be taken into account regarding the particular 
circumstances of different types of election or referenda? 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q7 Please state any case studies or scenarios you would like to see 
included in the code? 


Q8 Please state any examples of guidance, tools or good practice you 
have encountered that could aid compliance in this area, and could be 
included in the code. 
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Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q9 Name and contact details: 


Q10 Are you responding: 
[_] In your own capacity? 
[|_| On behalf of an organisation 


Please describe your role and your organisation: 


po 
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